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Introduction 


The IAB Europe CMP Validator (Validator) is a tool that helps Consent Management Providers 
(CMPs) and publishers check their compliance with the IAB Europe Transparency & Consent 
Framework (TCF) Technical Specifications and Policies. It can also be used by Vendors to 
check the compliance of their Publisher-partners, and by end-users who want to verify their 
preferences with respect to the processing of their personal data were saved faithfully. 


Privacy Disclosure 


Information about the device (such as the IP address of your Internet connection) is sent 
automatically to IAB Europe's servers when loading resources that are necessary for the CMP 
Validator to operate properly. Such information is not logged nor processed for other purposes. 


Installation 


Chrome browser extension 


The Validator is a Chrome extension. This enables the tool to analyse live CMP installations on 
any site. The extension can be used in the Windows or macOS versions of Chrome. It is not 
possible to add an extension to mobile or tablet browsers. 


Non-Web based CMPs 


If you have an in-app or non-Web based CMP you will not be able to use the Validator - please 
submit the appropriate form below as part of the compliance process instead of using the 
Validator: TCF v2.2 Compliance Form For Non-Web CMPs 


Access to the Validator 


The Validator has been published to the Chrome Web Store in public mode. Therefore it is not 
required to request access to the validator to IAB Europe. 


(0) 
o 
° 5 
IQD; 
© 


IAB EUROPE CMP VALIDATOR USER GUIDE / MAY 15TH 2023 


Installing the extension 


Follow these steps to enable the extension in Chrome: 


1. Sign in to Chrome 
2. Add extension to Chrome 
3. Allow extension to run in incognito mode 


1. Sign in to Chrome 


You must be signed in to Chrome to install the extension. You can sign in using the icon next to 
the settings in the top right hand corner of the browser. Note that the icon on your browser will 
be different to the one shown below. 


2. Add extension to Chrome 


e Use this link to view the extension in the Chrome Web Store: 


https://chrome.google.com/webstore/detail/cmp-validator/ffhhiklqcfabkpholngojpkijlafiooc 
I 


Confirm you want to add the extension by clicking ‘Add extension’. 
Chrome will then confirm that the extension has been added. 


3. Allow extension to run in incognito mode 


Some of the tests need to be run using Chrome’s incognito mode. Follow these steps to allow 
the extension to run when you launch an incognito browser window. 


Go to Settings > More tools > Extensions 

Find the IAB Europe CMP Validator extension and click on ‘Details’. 
Now toggle the ‘Allow in incognito’ option. 

That’s it, you’re done! 
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Getting started 


Once installed, you can browse to any Website and click the icon in the top bar to run the CMP 
Validator. 


The tool works by adding code into the actual Website being viewed. Note that on sites that load 
many third-party scripts, it can take a few seconds for the CMP Validator scripts to run. 


Clicking the icon in the top bar will activate the CMP Validator which will appear as a slider that 
overlays the site. 


You can dismiss the CMP Validator by clicking on the icon again, using the ‘X in the top right 
corner or clicking outside of the CMP Validator user interface, but you can also continue 
browsing while keeping the CMP Validator active by clicking the ‘>’ icon. 


Sites that do not have a CMP that supports the TCF 


If you run the CMP Validator on a site that does not have a CMP that supports the TCF you will 
see the following message: “No CMP API found on this webpage. CMP validator cannot 
operate.” 


Some sites implement a Content Security Policy that prevents unknown scripts from running on 


the page - in these cases the CMP Validator is not able to run and the following message will be 
shown. 


Using the CMP Validator 


The Validator has several feature areas: 
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Summary 

Technical compliance Checks 
Policies compliance Checks 
CMP and TCF API Checks 
TC String Check 

Purposes (Consent) 

Purpose (Legitimate Interest) 
Special Features 

Vendors (Consent) 

Vendors (Legitimate Interest) 


CMP Validator Footer options 


There are two options available in the footer of the Validator that allows you to download the 
results in CSV or to file a complaint with IAB Europe. 


Download CSV 


Click on ‘Download CSV’ to download all the data for all sites saved to date. 


File a complaint 


Click on ‘File a complaint’ to submit a non-compliance report to IAB Europe. 


Testing a site using ‘incognito’ mode 


Many of the checks in the Validator require simulating a first time user experience, so that the 
user interface of the CMP is shown on a given site. 


This can be difficult if you have already visited a site, as the CMP will know you are an existing 
user if a consent string is present and the user interface will not be shown. An easy way to 
simulate a first time user experience is to launch a window in Chrome’s ‘incognito’ mode. This 
creates a browser window with a clean slate where there are no cookies and no data in local 
storage (an alternative browser data storage facility similar to cookies) and therefore allows you 
to visit a site as a first time user, which should trigger the CMP. Follow these steps to use 
Chrome’s incognito mode: 
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1. Choose Settings > New incognito window 
2. Visit Publisher site - you should see a CMP as a first time user 


[lm a CMP, what do | have to do? 


All CMPs must use the Validator to test if their software complies with the Technical 
Specifications and Policies of the TCF when they register to the TCF, in order to complete the 
validation process. Already registered CMPs can use the Validator to self-test their live 
installations. 


This section assumes you have read through this user guide carefully to understand how the 
Validator works. 


As a CMP you must do the following: 


Run the Validator on a site where your CMP is installed 

Go through each of the manual checks 

Download CSV results 

Resolve any issues found within the timeframe provided by IAB Europe 


POON 


Run the Validator on a site where your CMP is installed 


Once you have installed the Validator you need to browse to a site where your CMP is running 
and simulate a first time user experience. 


If you are a new CMP and have no live installations, you may use a staging site where your 
CMP is being tested. 


Follow these steps: 


1. Open a standard Chrome browser window (not an incognito window) 

2. Browse to a site where your CMP is running 

3. Simulate a first time user experience so that your CMP appears - delete any cookies as 
necessary to trigger your CMP 

4. Accept the default settings 

5. Run the Validator 
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The Validator will appear and you will see the results of the technical compliance checks that 
run automatically. This will be where you will register the results of each manual check. 


Go through each of the manual checks 


You must now indicate ‘Pass’ or ‘Fail for each manual check. Before you run each manual 
check, click on the info icon (i) which will provide more information about the check and the 
steps required. 


Send CSV results to IAB Europe to complete the validation 
process 


After registering to TCF, CMPs need to complete the validation process before they can be 
attributed a CMP ID. When you have indicated ‘Pass’ or ‘Fail’ for all of the manual checks, you 
can save your results and send them to IAB Europe. 


Follow these steps: 


1. Click on the ‘Save to CSV’ option at the bottom of the Validator 
2. Download the CSV by clicking on the ‘Download CSV’ option 


3. Send the CSV file to tcf.compliance@iabeurope.eu 


Resolve any issues found 


If any of the checks have failed, you must fix the issues and re-send the test results to IAB 
Europe. 
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Frequently Asked Questions 


What is the IAB Europe CMP Validator? 


The IAB Europe CMP Validator (Validator) is a tool that helps Consent Management Providers 
(CMPs) and Publishers check their compliance with the IAB Europe Transparency & Consent 
Framework (TCF) Technical Specifications and Policies. It can also be used by Vendors to 
check the compliance of their Publisher-partners, and by end-users who want to verify their 
preferences with respect to the processing of their personal data were saved faithfully. 


Why was the Validator developed? 


Publishers and Vendors use CMPs to provide transparency, collect, store, and, where 
appropriate, share consent information across the advertising ecosystem in order to ensure 
compliance with the General Data Protection Regulation (GDPR). Today, more than 180 CMPs 
are registered with the TCF and fall under four categories: (1) those provided for use by multiple 
Publishers,(2) those built in-house by Publishers, (3) those built for Mobile and (4) those built for 
Connected TV. A CMP’s failure to accurately read and record consumers’ choices could not only 
subject Publishers and their Vendors to financial penalties but also reduce Publishers’ revenue 
and buyers’ opportunities. The IAB Europe CMP Validator exemplifies the association’s 
commitment to support the industry’s compliance with GDPR and the longer term commercial 
sustainability of the industry sector. 


Who developed the Validator? 


Developed by IAB Europe, the Validator is a comprehensive testing tool for use by all TCF 
registered CMPs. The tool has been developed with ease of usage and comprehensive 
feedback in mind. It is first and foremost a tool that has been developed to enable all CMPs to 
be fully aware of what is needed to comply with the Technical Specifications and Policies of the 
TCF. 


Is the Validator able to test for TCF v2.2? 


The Validator in its second iteration has been built to test a CMP compliance with TCF v2.2. 


0) 
o 
° 5 
IQD: 
9 


IAB EUROPE CMP VALIDATOR USER GUIDE / MAY 15TH 2023 


Has the TCF Validator been tested in-market? 


The Validator has undergone a rigorous process of development over several months. CMPs’ 
feedback has been invaluable enabling IAB Europe to deliver a ‘stand out’ tool. 


Where can I find the CMP Validator and how do I install it? 


The Validator is a Chrome extension and can be found in the Chrome Web Store 


Who can use the Validator? 


Anyone signed in Chrome on Web is able to install and use the Validator for TCF v2.2. 


What operating systems are compatible with the Validator? 


The extension can be used in the Windows or macOS versions of Chrome. It is not possible to 
add an extension to mobile or tablet browsers. 


Does the Validator run on mobile devices? 


No, unfortunately browser extensions only run on the desktop version of Chrome. If you have an 
in-app or non-Web based CMP please submit the appropriate form below as part of the 
validation process instead of using the Validator: TCF v2.2 Compliance Form For Non-Web 
CMPs 


| have a non-Web based CMP, can I use the Validator? 


No, unfortunately browser extensions only run on the desktop version of Chrome. If you have an 
in-app or non-Web based CMP please submit the appropriate form below as part of the 
validation process instead of using the Validator: TCF v2.2 Compliance Form For Non-Web 
CMPs 


How do I get the latest version of the Validator? 


The Validator is self-updating. Most of the time you will simply be using the latest version of the 
Validator without realising it. If there has been a recent update and you cannot see a new 
feature, you may need to clear your cache: 
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Settings > More tools > Clear browsing data... 


Make sure you only clear ‘Cached images and files’ for the last hour to avoid logging yourself 
out of other sites. 


Clear browsing data 


Basic Advanced 
Time range Last hour v 


Browsing history 
(Clears history from all signed-in devices. Your Google Account may have 


other forms of browsing history at myactivity.google.com 


Cookies and other site data 


oO Signs you out of most sites. You'll stay signed in to your Google Account so 


that your synced data can be cleared 


Cached images and files 


Frees up less than 320 MB. Some sites may load more slowly on your next 


visit 


Cancel Clear data 


Click on “Click data” and it’s done! 


How will the Validator be used by IAB Europe? 


The Validator will be principally used to test new CMPs for compliance during the registration 
process before they are published on the CMP List and it will be used to audit running CMP 
installations. 


What is the validation process for new CMPs? 


All new CMP registrations are required to take the test and demonstrate operational compliance 
before they are issued with a CMP ID that enables them to participate in the TCF. 
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If a CMP does not pass the validation requirements, what will be 
the next steps? 


If a CMP returns a test that shows failures then the MO will ask the CMP to rectify the failures. 
CMP that do not pass all validation requirements will not be issued with a CMP ID.. 


What is the TCF Enforcement process? 


The CMP Compliance programme comprises a pre-implementation validation stage and a 
post-implementation enforcement stage - whereby IAB Europe monitors live CMP 
implementations for compliance with the TCF Policies. The CMP enforcement process can be 
found here. 


Does TCF have a Compliance Programme? 


With TCF v2.2 release IAB Europe has updated the TCF Compliance Programmes: 


The updated programmes include stricter and differentiated enforcement procedures and 
sanctions for non-compliance: 


1. CMPs & Vendors’ live installations tampering with the TC Strings will be suspended 
for a minimum of 4 weeks until issues are resolved. After three temporary suspensions 
the TCF participant will be suspended permanently from the TCF. In case of a 
suspension IAB Europe will send a public notification to the TCF Community, including 
facts and reasoning for the suspension. 

2. CMPs & Vendors’ live installations demonstrating other material breaches of the 
TCF Policy will receive a heads-up notification that breaches have been found and be 
given a week to resolve them. Failing to resolve these issues within a week, they will 
receive a suspension warning with 10 to 20 business days to resolve the issues. Failing 
to resolve these issues within the 10 to 20 days they will be temporarily suspended from 
the TCF until issues are resolved. 
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